48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b

Sharing

Copy URL

Twitter E-mail

General

Target

48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b
Size

42KB
MD5

621e294da3d079e3d5b57836e487812a
SHA1

4652280ed016154900b0846f777278c0bab17453
SHA256

48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b
SHA512

99264960418691f2d3f374c8149fb1b7a0276fcd179a2bd9d945ddf92e88c68df6542d8ddc7ebb1c6d70f1c7fd9687f1ee102e71e69211ba20d0eb3928a6e30e
SSDEEP

768:Ybb75EEnHDxr5KI3dOm+I4oU5xWw4HPf84q+lniu82me6Y+V2kw53iGf2mmqSZO8:mtEEjxrMS+J52HX8Jme5rGXMygAm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b

Files

48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b
.xll windows:6 windows x86 arch:x86

c9392de2516017ac2779e57b52080304

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\user\HelloWorldXll-master\Release\HelloWorldXll.pdb

Imports

xlcall32

ord2

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent

shell32

ShellExecuteExW

msvcp140

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

urlmon

URLDownloadToFileW

vcruntime140

memset
__current_exception_context
memmove
__std_type_info_destroy_list
__std_exception_copy
__std_terminate
__CxxFrameHandler3
_except_handler4_common
__std_exception_destroy
_CxxThrowException
memcpy
__current_exception

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initterm
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
terminate
_initterm_e
_initialize_narrow_environment
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-stdio-l1-1-0

fputc
fsetpos
setvbuf
fflush
fgetpos
fclose
fwrite
ungetc
_fseeki64
fgetc
_get_stream_buffer_pointers
fread

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

Exports

Exports

xlAutoOpen

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9392de2516017ac2779e57b52080304

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

xlcall32

kernel32

shell32

msvcp140

urlmon

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB